Control Center privacy notice
Updated 30 September 2026
Who is responsible?
EBX Technologies GmbH, Leopoldstraße 20, 80802 Munich, Germany, is responsible for the product analytics described here. Contact privacy@ebx.energy for privacy questions and requests. This notice covers Control Center, including external partner onboarding; it is separate from our public website notice.
What we collect and why
We record account UUID, account email, display name when available, roles and registered company; visited page categories, actions and errors; and asset/onboarding identifiers, milestone changes and timestamps. We use these data to understand adoption, diagnose problems and measure onboarding and approval delays across long asset integration cycles. Data come from your signed-in account, your portal interactions and the corresponding backend activity. Requests also involve technical connection information such as IP addresses; PostHog may derive approximate location from them.
Limits on analytics
We send selected events, not recordings of your screen or every click. We exclude passwords, authentication links/tokens, raw URL queries, free-text notes, uploaded document contents and ordinary form values from product analytics. PostHog state is kept in page memory rather than analytics cookies or local storage. Necessary sign-in and portal-preference storage is separate. We do not use these analytics for advertising or automated decisions with legal or similarly significant effects on you.
Legal basis and your choice
Product analytics is based on our legitimate interests in operating and improving Control Center and understanding onboarding delays (Article 6(1)(f) GDPR). A contract with your employer does not waive your individual rights. Participation in product analytics is not a contractual requirement for you; an objection does not prevent you from using the portal.
Your right to object to product analytics
You can object to this processing under Article 21 GDPR. Email privacy@ebx.energy from your account email address and ask to be excluded from Control Center product analytics. We will verify the account and exclude its UUID from browser and backend analytics. You do not need to obtain your employer’s permission. We acknowledge and handle requests without undue delay, normally within one month. Exclusion stops future collection after propagation; separately request deletion if you also want existing analytics reviewed for erasure.
Contact privacy@ebx.energyRecipients and international transfers
Authorized EBX personnel use the analytics. We use PostHog Cloud EU for analytics storage in the EU. PostHog Inc. and its subprocessors provide this service; EU hosting does not by itself exclude support access or international transfers. Where processing outside the EEA occurs, applicable adequacy decisions or appropriate safeguards, including standard contractual clauses, are required. Contact us for information and copies of the safeguards applicable to your data. PostHog publishes its processing terms and subprocessor information below.
How long we keep data
Our default maximum retention for identifiable product analytics is five years from the event. This supports comparison across long onboarding cycles and subsequent improvements; we review necessity and delete earlier when the purpose no longer requires the data or an applicable erasure request is granted. Associated profile information is removed when no longer needed. We retain the minimum exclusion record while necessary to honor your objection. Operational asset records, security logs and legally required records have separate purposes and retention criteria; an analytics objection does not delete those records.
Your other rights
Depending on the applicable conditions, you can request access, correction, erasure, restriction and data portability. Contact privacy@ebx.energy to exercise these rights. We may need to verify your identity. You can complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA), or the authority where you live or work.
Essential portal processing
Authentication, access permissions, your company membership and asset/onboarding records are also processed to provide a secure service to your organization and maintain operational accountability. This is separate from optional product analytics and is based on the applicable service, security and legal purposes. Contact us for details of the processing and retention applicable to your account and asset records.
PostHog DPA · PostHog subprocessors · BayLDA
Back to Control Center